#!/usr/bin/env python3
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

import os
import sys
import shutil
import re
import tempfile
from optparse import OptionParser
from subprocess import check_call
from subprocess import check_output

nssutil_h = "lib/util/nssutil.h"
softkver_h = "lib/softoken/softkver.h"
nss_h = "lib/nss/nss.h"
nssckbi_h = "lib/ckfw/builtins/nssckbi.h"
abi_base_version_file = "automation/abi-check/previous-nss-release"

abi_report_files = [
    "automation/abi-check/expected-report-libfreebl3.so.txt",
    "automation/abi-check/expected-report-libfreeblpriv3.so.txt",
    "automation/abi-check/expected-report-libnspr4.so.txt",
    "automation/abi-check/expected-report-libnss3.so.txt",
    "automation/abi-check/expected-report-libnssckbi.so.txt",
    "automation/abi-check/expected-report-libnssdbm3.so.txt",
    "automation/abi-check/expected-report-libnsssysinit.so.txt",
    "automation/abi-check/expected-report-libnssutil3.so.txt",
    "automation/abi-check/expected-report-libplc4.so.txt",
    "automation/abi-check/expected-report-libplds4.so.txt",
    "automation/abi-check/expected-report-libsmime3.so.txt",
    "automation/abi-check/expected-report-libsoftokn3.so.txt",
    "automation/abi-check/expected-report-libssl3.so.txt",
]


def check_call_noisy(cmd, *args, **kwargs):
    print("Executing command: {}".format(cmd))
    check_call(cmd, *args, **kwargs)


def print_separator():
    print("=" * 70)


def exit_with_failure(what):
    print("failure: {}".format(what))
    sys.exit(2)


def check_files_exist():
    if (
        not os.path.exists(nssutil_h)
        or not os.path.exists(softkver_h)
        or not os.path.exists(nss_h)
        or not os.path.exists(nssckbi_h)
    ):
        exit_with_failure(
            "cannot find expected header files, must run from inside NSS hg directory"
        )


class Replacement:
    def __init__(self, regex="", repl=""):
        self.regex = regex
        self.repl = repl
        self.matcher = re.compile(self.regex)

    def replace(self, line):
        return self.matcher.sub(self.repl, line)


def inplace_replace(replacements=[], filename=""):
    for r in replacements:
        if not isinstance(r, Replacement):
            raise TypeError("Expecting a list of Replacement objects")

    with tempfile.NamedTemporaryFile(mode="w", delete=False) as tmp_file:
        with open(filename) as in_file:
            for line in in_file:
                for r in replacements:
                    line = r.replace(line)
                tmp_file.write(line)
        tmp_file.flush()

        shutil.copystat(filename, tmp_file.name)
        shutil.move(tmp_file.name, filename)
        os.utime(filename, None)


def toggle_beta_status(is_beta):
    check_files_exist()
    if is_beta:
        print("adding Beta status to version numbers")
        inplace_replace(
            filename=nssutil_h,
            replacements=[
                Replacement(
                    regex=r"^(#define *NSSUTIL_VERSION *\"[0-9.]+)\" *$",
                    repl=r'\g<1> Beta"',
                ),
                Replacement(
                    regex=r"^(#define *NSSUTIL_BETA *)PR_FALSE *$", repl=r"\g<1>PR_TRUE"
                ),
            ],
        )
        inplace_replace(
            filename=softkver_h,
            replacements=[
                Replacement(
                    regex=r"^(#define *SOFTOKEN_VERSION *\"[0-9.]+\" *SOFTOKEN_ECC_STRING) *$",
                    repl=r'\g<1> " Beta"',
                ),
                Replacement(
                    regex=r"^(#define *SOFTOKEN_BETA *)PR_FALSE *$",
                    repl=r"\g<1>PR_TRUE",
                ),
            ],
        )
        inplace_replace(
            filename=nss_h,
            replacements=[
                Replacement(
                    regex=r"^(#define *NSS_VERSION *\"[0-9.]+\" *_NSS_CUSTOMIZED) *$",
                    repl=r'\g<1> " Beta"',
                ),
                Replacement(
                    regex=r"^(#define *NSS_BETA *)PR_FALSE *$", repl=r"\g<1>PR_TRUE"
                ),
            ],
        )
    else:
        print("removing Beta status from version numbers")
        inplace_replace(
            filename=nssutil_h,
            replacements=[
                Replacement(
                    regex=r"^(#define *NSSUTIL_VERSION *\"[0-9.]+) *Beta\" *$",
                    repl=r'\g<1>"',
                ),
                Replacement(
                    regex=r"^(#define *NSSUTIL_BETA *)PR_TRUE *$", repl=r"\g<1>PR_FALSE"
                ),
            ],
        )
        inplace_replace(
            filename=softkver_h,
            replacements=[
                Replacement(
                    regex=r"^(#define *SOFTOKEN_VERSION *\"[0-9.]+\" *SOFTOKEN_ECC_STRING) *\" *Beta\" *$",
                    repl=r"\g<1>",
                ),
                Replacement(
                    regex=r"^(#define *SOFTOKEN_BETA *)PR_TRUE *$",
                    repl=r"\g<1>PR_FALSE",
                ),
            ],
        )
        inplace_replace(
            filename=nss_h,
            replacements=[
                Replacement(
                    regex=r"^(#define *NSS_VERSION *\"[0-9.]+\" *_NSS_CUSTOMIZED) *\" *Beta\" *$",
                    repl=r"\g<1>",
                ),
                Replacement(
                    regex=r"^(#define *NSS_BETA *)PR_TRUE *$", repl=r"\g<1>PR_FALSE"
                ),
            ],
        )

    print(
        "please run 'hg stat' and 'hg diff' to verify the files have been verified correctly"
    )


def print_beta_versions():
    check_call_noisy(
        ["egrep", "#define *NSSUTIL_VERSION|#define *NSSUTIL_BETA", nssutil_h]
    )
    check_call_noisy(
        ["egrep", "#define *SOFTOKEN_VERSION|#define *SOFTOKEN_BETA", softkver_h]
    )
    check_call_noisy(["egrep", "#define *NSS_VERSION|#define *NSS_BETA", nss_h])


def remove_beta_status():
    print("--- removing beta flags. Existing versions were:")
    print_beta_versions()
    toggle_beta_status(False)
    print("=" * 70)
    print("--- finished modifications, new versions are:")
    print("=" * 70)
    print_beta_versions()


def set_beta_status():
    print("--- adding beta flags. Existing versions were:")
    print_beta_versions()
    toggle_beta_status(True)
    print("--- finished modifications, new versions are:")
    print_beta_versions()


def print_library_versions():
    check_files_exist()
    check_call_noisy(
        [
            "egrep",
            "#define *NSSUTIL_VERSION|#define NSSUTIL_VMAJOR|#define *NSSUTIL_VMINOR|#define *NSSUTIL_VPATCH|#define *NSSUTIL_VBUILD|#define *NSSUTIL_BETA",
            nssutil_h,
        ]
    )
    check_call_noisy(
        [
            "egrep",
            "#define *SOFTOKEN_VERSION|#define SOFTOKEN_VMAJOR|#define *SOFTOKEN_VMINOR|#define *SOFTOKEN_VPATCH|#define *SOFTOKEN_VBUILD|#define *SOFTOKEN_BETA",
            softkver_h,
        ]
    )
    check_call_noisy(
        [
            "egrep",
            "#define *NSS_VERSION|#define NSS_VMAJOR|#define *NSS_VMINOR|#define *NSS_VPATCH|#define *NSS_VBUILD|#define *NSS_BETA",
            nss_h,
        ]
    )


def print_root_ca_version():
    check_files_exist()
    check_call_noisy(["grep", "define *NSS_BUILTINS_LIBRARY_VERSION", nssckbi_h])


def ensure_arguments_count(args, how_many, usage):
    if len(args) != how_many:
        exit_with_failure(
            "incorrect number of arguments, expected parameters are:\n" + usage
        )


def set_major_versions(major):
    for name, file in [
        ["NSSUTIL_VMAJOR", nssutil_h],
        ["SOFTOKEN_VMAJOR", softkver_h],
        ["NSS_VMAJOR", nss_h],
    ]:
        inplace_replace(
            filename=file,
            replacements=[
                Replacement(
                    regex=r"^(#define *{} ?).*$".format(name),
                    repl=r"\g<1>{}".format(major),
                )
            ],
        )


def set_minor_versions(minor):
    for name, file in [
        ["NSSUTIL_VMINOR", nssutil_h],
        ["SOFTOKEN_VMINOR", softkver_h],
        ["NSS_VMINOR", nss_h],
    ]:
        inplace_replace(
            filename=file,
            replacements=[
                Replacement(
                    regex=r"^(#define *{} ?).*$".format(name),
                    repl=r"\g<1>{}".format(minor),
                )
            ],
        )


def set_patch_versions(patch):
    for name, file in [
        ["NSSUTIL_VPATCH", nssutil_h],
        ["SOFTOKEN_VPATCH", softkver_h],
        ["NSS_VPATCH", nss_h],
    ]:
        inplace_replace(
            filename=file,
            replacements=[
                Replacement(
                    regex=r"^(#define *{} ?).*$".format(name),
                    repl=r"\g<1>{}".format(patch),
                )
            ],
        )


def set_build_versions(build):
    for name, file in [
        ["NSSUTIL_VBUILD", nssutil_h],
        ["SOFTOKEN_VBUILD", softkver_h],
        ["NSS_VBUILD", nss_h],
    ]:
        inplace_replace(
            filename=file,
            replacements=[
                Replacement(
                    regex=r"^(#define *{} ?).*$".format(name),
                    repl=r"\g<1>{}".format(build),
                )
            ],
        )


def set_full_lib_versions(version):
    for name, file in [
        ["NSSUTIL_VERSION", nssutil_h],
        ["SOFTOKEN_VERSION", softkver_h],
        ["NSS_VERSION", nss_h],
    ]:
        inplace_replace(
            filename=file,
            replacements=[
                Replacement(
                    regex=r"^(#define *{} *\")([0-9.]+)(.*)$".format(name),
                    repl=r"\g<1>{}\g<3>".format(version),
                )
            ],
        )


def set_root_ca_version(args):
    ensure_arguments_count(args, 2, "major_version  minor_version")
    major = args[0].strip()
    minor = args[1].strip()
    version = major + "." + minor

    inplace_replace(
        filename=nssckbi_h,
        replacements=[
            Replacement(
                regex=r"^(#define *NSS_BUILTINS_LIBRARY_VERSION *\").*$",
                repl=r'\g<1>{}"'.format(version),
            ),
            Replacement(
                regex=r"^(#define *NSS_BUILTINS_LIBRARY_VERSION_MAJOR ?).*$",
                repl=r"\g<1>{}".format(major),
            ),
            Replacement(
                regex=r"^(#define *NSS_BUILTINS_LIBRARY_VERSION_MINOR ?).*$",
                repl=r"\g<1>{}".format(minor),
            ),
        ],
    )


def set_all_lib_versions(version, major, minor, patch, build):
    grep_major = check_output(["grep", "define.*NSS_VMAJOR", nss_h])
    grep_minor = check_output(["grep", "define.*NSS_VMINOR", nss_h])

    old_major = int(grep_major.split()[2])
    old_minor = int(grep_minor.split()[2])

    new_major = int(major)
    new_minor = int(minor)

    if old_major < new_major or (old_major == new_major and old_minor < new_minor):
        print("You're increasing the minor (or major) version:")
        print("- erasing ABI comparison expectations")
        new_branch = "NSS_" + str(old_major) + "_" + str(old_minor) + "_BRANCH"
        print(
            "- setting reference branch to the branch of the previous version: "
            + new_branch
        )
        with open(abi_base_version_file, "w") as abi_base:
            abi_base.write("%s\n" % new_branch)
        for report_file in abi_report_files:
            with open(report_file, "w") as report_file_handle:
                report_file_handle.truncate()

    set_full_lib_versions(version)
    set_major_versions(major)
    set_minor_versions(minor)
    set_patch_versions(patch)
    set_build_versions(build)


def set_version_to_minor_release(args):
    ensure_arguments_count(args, 2, "major_version  minor_version")
    major = args[0].strip()
    minor = args[1].strip()
    version = major + "." + minor
    patch = "0"
    build = "0"
    set_all_lib_versions(version, major, minor, patch, build)


def set_version_to_patch_release(args):
    ensure_arguments_count(args, 3, "major_version  minor_version  patch_release")
    major = args[0].strip()
    minor = args[1].strip()
    patch = args[2].strip()
    version = major + "." + minor + "." + patch
    build = "0"
    set_all_lib_versions(version, major, minor, patch, build)


def set_release_candidate_number(args):
    ensure_arguments_count(args, 1, "release_candidate_number")
    build = args[0].strip()
    set_build_versions(build)


def set_4_digit_release_number(args):
    ensure_arguments_count(
        args, 4, "major_version  minor_version  patch_release  4th_digit_release_number"
    )
    major = args[0].strip()
    minor = args[1].strip()
    patch = args[2].strip()
    build = args[3].strip()
    version = major + "." + minor + "." + patch + "." + build
    set_all_lib_versions(version, major, minor, patch, build)


def make_release_branch(args):
    ensure_arguments_count(args, 2, "version_string remote")
    version_string = args[0].strip()
    remote = args[1].strip()

    major, minor, patch = parse_version_string(version_string)
    if patch is not None:
        exit_with_failure(
            "make_release_branch expects a minor version (e.g., '3.117'), not a patch version."
        )

    version = f"{major}.{minor}"
    branch_name = f"NSS_{major}_{minor}_BRANCH"
    tag_name = f"NSS_{major}_{minor}_BETA1"

    print_separator()
    print("MAKE RELEASE BRANCH")
    print_separator()
    print(f"Version: {version}")
    print(f"Remote: {remote}")
    print_separator()

    response = input("Are these parameters correct? [yN]: ")
    if "y" not in response.lower():
        print("Aborted.")
        sys.exit(0)
    print_separator()

    # Step 1: Update local repo
    print("Step 1: Updating local repository...")
    check_call_noisy(["hg", "pull"])
    check_call_noisy(["hg", "checkout", "default"])
    print_separator()

    print("Step 2: Checking working directory is clean")
    hg_status = check_output(["hg", "status"]).decode("utf-8").strip()
    if hg_status:
        print()
        print("ERROR: Working directory is not clean")
        print(hg_status)
        print()
        exit_with_failure(
            "Please commit or revert changes then run this command again. You can reset your working directory with 'hg update -C' and 'hg purge if you want to discard all local changes."
        )

    branches = check_output(["hg", "branches"]).decode("utf-8").strip()
    if branch_name in branches:
        exit_with_failure(f"Branch {branch_name} already exists.")
    print_separator()

    # Step 2: Verify version numbers are correct
    print("Step 2: Verifying version numbers are correct...")
    set_version_to_minor_release([major, minor])
    print("=" * 70)
    set_beta_status()
    print("=" * 70)
    # Check if there are any uncommitted changes
    hg_status = check_output(["hg", "status"]).decode("utf-8").strip()
    if hg_status:
        print()
        print("ERROR: Version numbers are not correctly set")
        print()
        print()
        exit_with_failure(
            "Please check the correct version to freeze, or update the version numbers then run this command again."
        )

    print("Version numbers verified - no changes needed.")
    print_separator()

    # Step 3: Create branch
    print(f"Step 3: Creating branch {branch_name}...")
    check_call_noisy(["hg", "branch", branch_name])
    print_separator()

    # Step 4: Create tag
    print(f"Step 4: Creating tag {tag_name}...")
    check_call_noisy(["hg", "tag", tag_name])
    print_separator()

    # Step 5: Show outgoing changes
    response = input("Display outgoing changes? [yN]: ")
    if "y" in response.lower():
        print()
        check_call_noisy(["hg", "outgoing", "-p", remote])
    print_separator()

    # Step 6: Prompt user and push if confirmed
    response = input("Push this branch and tag to the NSS repository? [yN]: ")
    if "y" in response.lower():
        print("Pushing branch and tag...")
        check_call_noisy(["hg", "push", "--new-branch", remote])
        print_separator()
        print("SUCCESS: Branch and tag have been pushed!")
        print_separator()
        print()
        print("NEXT STEPS:")
        print(
            f"1. Wait for the changes to sync to Github: https://github.com/mozilla/nss/tree/{branch_name}"
        )
        print("2. In your mozilla-unified repository, run:")
        print(f"   ./mach nss-uplift {tag_name}")
        print()
    else:
        print("Branch and tag have NOT been pushed to the repository.")
        print("The local branch and tag remain in your working directory.")
        print_separator()


def parse_version_string(version_string):
    """Parse a version string like '3.117' or '3.117.1' and return (major, minor, patch)

    For versions like '3.117', patch will be None.
    Returns: tuple of (major, minor, patch) where patch can be None
    """
    parts = version_string.split(".")
    if len(parts) < 2:
        exit_with_failure(
            f"Invalid version string '{version_string}'. Expected format: 'major.minor' or 'major.minor.patch'"
        )

    major = parts[0].strip()
    minor = parts[1].strip()
    patch = parts[2].strip() if len(parts) >= 3 else None

    # Validate that they're numbers
    try:
        int(major)
        int(minor)
        if patch is not None:
            int(patch)
    except ValueError:
        exit_with_failure(
            f"Invalid version string '{version_string}'. Version components must be numbers."
        )

    return major, minor, patch


def version_string_to_RTM_tag(version_string):
    parts = version_string.split(".")
    return "NSS_" + "_".join(parts) + "_RTM"


def version_string_to_underscore(version_string):
    return version_string.replace(".", "_")


def generate_release_note(args):
    ensure_arguments_count(
        args,
        3,
        "this_release_version_string revision_or_tag previous_release_version_string ",
    )

    version = args[0].strip()
    this_tag = args[1].strip()  # Typically going to be .
    version_underscore = version_string_to_underscore(version)
    prev_tag = version_string_to_RTM_tag(args[2].strip())

    # Get the NSPR version
    nspr_version = (
        check_output(
            ["hg", "cat", "-r", this_tag, "automation/release/nspr-version.txt"]
        )
        .decode("utf-8")
        .split("\n")[0]
        .strip()
    )

    # Get the current date
    from datetime import datetime

    current_date = datetime.now().strftime("%-d %B %Y")

    # Get the list of bugs from hg log
    # Get log entries between previous tag and current HEAD
    command = [
        "hg",
        "log",
        "-r",
        f"{prev_tag}:{this_tag}",
        "--template",
        "{desc|firstline}\\n",
    ]
    log_output = check_output(command).decode("utf-8")

    # Extract bug numbers and descriptions
    bug_lines = []
    for line in reversed(log_output.split("\n")):
        if "Bug" in line or "bug" in line:
            line = line.strip()
            line = line.split("r=")[0].strip()

            # Match patterns like "Bug 1234567 Something" and convert to "Bug 1234567 - Something"
            line = re.sub(
                r"(Bug\s+\d+)\s+([^-])", r"\1 - \2", line, flags=re.IGNORECASE
            )

            # Add a full stop at the end if there isn't one
            if line:
                line = line.rstrip(",")

            if line and not line.endswith("."):
                line = line + "."

            if line and line not in bug_lines:
                bug_lines.append(line)

    changes_text = "\n".join([f"   - {line}" for line in bug_lines])

    # Create the release notes content
    rst_content = f""".. _mozilla_projects_nss_nss_{version_underscore}_release_notes:

NSS {version} release notes
===============================

`Introduction <#introduction>`__
--------------------------------

.. container::

   Network Security Services (NSS) {version} was released on *{current_date}**.

`Distribution Information <#distribution_information>`__
--------------------------------------------------------

.. container::

   The HG tag is NSS_{version_underscore}_RTM. NSS {version} requires NSPR {nspr_version} or newer.

   NSS {version} source distributions are available on ftp.mozilla.org for secure HTTPS download:

   -  Source tarballs:
      https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_{version_underscore}_RTM/src/

   Other releases are available :ref:`mozilla_projects_nss_releases`.

.. _changes_in_nss_{version}:

`Changes in NSS {version} <#changes_in_nss_{version}>`__
------------------------------------------------------------------

.. container::

{changes_text}

"""
    return rst_content


def generate_release_notes_index(args):
    ensure_arguments_count(args, 2, "latest_release_version  latest_esr_version")
    latest_version = args[0].strip()  # e.g. 3.116
    esr_version = args[1].strip()  # e.g. 3.112.1

    latest_underscore = version_string_to_underscore(latest_version)
    esr_underscore = version_string_to_underscore(esr_version)

    # Read all release note files from doc/rst/releases/
    release_dir = "doc/rst/releases"
    if not os.path.exists(release_dir):
        exit_with_failure(f"Release notes directory not found: {release_dir}")

    # Get all nss_*.rst files (excluding index.rst)
    release_files = []
    for filename in os.listdir(release_dir):
        if (
            filename.startswith("nss_")
            and filename.endswith(".rst")
            and filename != "index.rst"
        ):
            release_files.append(filename)

    # Sort release files in reverse order (newest first)
    # Extract version numbers for proper sorting
    def version_key(filename):
        # Extract version parts from filename like nss_3_116.rst
        parts = filename.replace("nss_", "").replace(".rst", "").split("_")
        # Convert to integers for proper numerical sorting
        return [int(p) for p in parts]

    release_files.sort(key=version_key, reverse=True)

    # Build the toctree content
    toctree_lines = "\n".join([f"   {f}" for f in release_files])

    # Create the index.rst content
    index_content = f""".. _mozilla_projects_nss_releases:

Release Notes
=============

.. toctree::
   :maxdepth: 0
   :glob:
   :hidden:

{toctree_lines}

.. note::

   **NSS {latest_version}** is the latest version of NSS.
   Complete release notes are available here: :ref:`mozilla_projects_nss_nss_{latest_underscore}_release_notes`

   **NSS {esr_version} (ESR)** is the latest ESR version of NSS.
   Complete release notes are available here: :ref:`mozilla_projects_nss_nss_{esr_underscore}_release_notes`

"""

    index_file = os.path.join(release_dir, "index.rst")
    with open(index_file, "w") as f:
        f.write(index_content)

    print(f"Generated {index_file}")
    print()
    print("=" * 70)
    print("Content:")
    print("=" * 70)
    print(index_content)


def release_nss(args):
    ensure_arguments_count(args, 3, "version_string  esr_version  remote")
    version_string = args[0].strip()
    esr_version = args[1].strip()
    remote = args[2].strip()

    major, minor, patch = parse_version_string(version_string)

    # Build version string and related names
    version = version_string
    version_underscore = version_string_to_underscore(version_string)
    branch_name = f"NSS_{major}_{minor}_BRANCH"
    rtm_tag = f"NSS_{version_underscore}_RTM"
    release_note_file = f"doc/rst/releases/nss_{version_underscore}.rst"

    print_separator()
    print("RELEASE NSS")
    print_separator()
    print(f"Release version: {version}")
    print(f"ESR version: {esr_version}")
    print(f"Remote: {remote}")
    print_separator()

    response = input("Are these parameters correct? [yN]: ")
    if "y" not in response.lower():
        print("Aborted.")
        sys.exit(0)
    print_separator()

    print("=" * 70)
    print(f"Starting NSS {version} release process")
    print("=" * 70)
    print()

    # Step 1: Update local repo
    print("Step 1: Updating local repository...")
    check_call_noisy(["hg", "pull"])
    print_separator()

    # Step 2: Checking working directory is clean
    print("Step 2: Checking working directory is clean...")
    hg_status = check_output(["hg", "status"]).decode("utf-8").strip()
    if hg_status:
        print()
        print("ERROR: Working directory is not clean")
        print(hg_status)
        print()
        exit_with_failure(
            "Please commit or revert changes then run this command again. You can reset your working directory with 'hg update -C' and 'hg purge if you want to discard all local changes."
        )
    print_separator()

    # Step 3: Make sure we're on the appropriate branch
    print(f"Step 3: Checking out branch {branch_name}...")
    try:
        check_call_noisy(["hg", "checkout", branch_name])
    except Exception as e:
        exit_with_failure(f"Failed to checkout branch {branch_name}. Does it exist?")
    print_separator()

    # Step 4: Check for any existing commits or tags
    print("Step 4: Checking for existing release commits or tags...")

    # Check if RTM tag already exists
    tags_output = check_output(["hg", "tags"]).decode("utf-8")
    if rtm_tag in tags_output:
        exit_with_failure(
            f"Tag {rtm_tag} already exists. Has this release already been made?"
        )

    # Check for recent commits with the same commit messages we're about to make
    version_commit_message = f"Set version numbers to {version} final"
    release_notes_commit_message = f"Release notes for NSS {version}"

    recent_log = check_output(
        ["hg", "log", "-l", "5", "--template", "{desc|firstline}\\n"]
    ).decode("utf-8")

    if version_commit_message in recent_log:
        exit_with_failure(
            f"Found recent commit with message '{version_commit_message}'. Has this release already been started?"
        )

    if release_notes_commit_message in recent_log:
        exit_with_failure(
            f"Found recent commit with message '{release_notes_commit_message}'. Has this release already been started?"
        )

    print("No existing release commits or tags found.")
    print_separator()

    # Step 5: Update the NSS version numbers (remove beta)
    print("Step 5: Removing beta status from version numbers...")
    if patch:
        set_version_to_patch_release([major, minor, patch])
    else:
        set_version_to_minor_release([major, minor])
    remove_beta_status()

    print_separator()

    # Step 6: Commit the change
    print("Step 6: Committing version number changes...")
    check_call_noisy(["hg", "commit", "-m", version_commit_message])
    print_separator()

    # Step 7: Generate release note
    print("Step 7: Generating release notes...")
    generate_doc_script = os.path.join(
        os.path.dirname(__file__), "generate_release_doc.py"
    )
    check_call_noisy([sys.executable, generate_doc_script, version])
    print_separator()

    # Step 8: Generate new release note index
    print("Step 8: Generating release notes index...")
    generate_release_notes_index([version, esr_version])
    print_separator()

    input(
        "Are you making an ESR release? If so, please manually edit doc/rst/releases/index.rst to adjust the ESR / main version note. Press enter when done."
    )

    # Step 9: Commit the release notes
    print("Step 9: Committing release notes...")
    check_call_noisy(["hg", "add", release_note_file])
    check_call_noisy(["hg", "commit", "-m", release_notes_commit_message])

    # Get the commit hash
    docs_commit = (
        check_output(["hg", "log", "-r", ".", "--template", "{node|short}"])
        .decode("utf-8")
        .strip()
    )
    print(f"Release notes committed. Commit hash: {docs_commit}")
    print_separator()

    # Step 10: Tag the release version
    print(f"Step 10: Tagging release version {rtm_tag}...")
    check_call_noisy(["hg", "tag", rtm_tag])
    print_separator()

    # Step 11: Switch to default branch and graft the release notes
    print("Step 11: Switching to default branch and grafting release notes...")
    check_call_noisy(["hg", "checkout", "default"])
    check_call_noisy(["hg", "graft", "-r", docs_commit])
    print_separator()

    response = input("Display the outgoing changes? [yN]: ")
    if "y" in response.lower():
        check_call_noisy(
            ["hg", "outgoing", "--graph", "-b", "default", "-b", branch_name, remote]
        )
    print_separator()

    # Step 12: Check cf_status_nss on Bugzilla
    print("Step 12: Checking cf_status_nss on Bugzilla...")
    cf_status_script = os.path.join(
        os.path.dirname(__file__), "bugzilla_cf_status_nss.py"
    )
    check_call_noisy([sys.executable, cf_status_script, version])
    input("Review the cf_status_nss report above. Press Enter to continue.")
    print_separator()

    # Step 13: Push changes
    response = input("Push these changes to the NSS repository? [yN]: ")
    if "y" in response.lower():
        print("Pushing changes to default branch...")
        check_call_noisy(["hg", "push", "-b", "default", remote])
        print(f"Pushing changes to {branch_name} branch...")
        check_call_noisy(["hg", "push", "-b", branch_name, remote])
        print_separator()
        print("SUCCESS: NSS release process completed!")
        print_separator()
        print()
        print("NEXT STEPS:")
        print(f"1. Wait for the changes to sync to Github")
        print("2. In your mozilla-unified repository, run:")
        print(f"   ./mach nss-uplift {rtm_tag}")
        print()
    else:
        print("Changes have NOT been pushed to the repository.")
        print("The local commits remain in your working directory.")
        print_separator()


def create_nss_release_archive(args):
    ensure_arguments_count(args, 2, "nss_release_version  path_to_stage_directory")
    nssrel = args[0].strip()  # e.g. 3.19.3
    stagedir = args[1].strip()  # e.g. ../stage

    # Determine which tar command to use (prefer gtar if available)
    tar_cmd = "gtar"
    try:
        check_call(
            ["which", "gtar"],
            stdout=open(os.devnull, "w"),
            stderr=open(os.devnull, "w"),
        )
    except:
        tar_cmd = "tar"

    # Generate the release tag from the version
    nssreltag = version_string_to_RTM_tag(nssrel)

    print_separator()
    print("CREATE NSS RELEASE ARCHIVE")
    print_separator()
    print(f"NSS release version: {nssrel}")
    print(f"Stage directory: {stagedir}")
    print_separator()

    response = input("Are these parameters correct? [yN]: ")
    if "y" not in response.lower():
        print("Aborted.")
        sys.exit(0)
    print_separator()

    with open("automation/release/nspr-version.txt") as nspr_version_file:
        nsprrel = next(nspr_version_file).strip()

    nspr_tar = "nspr-" + nsprrel + ".tar.gz"
    nspr_dir = stagedir + "/v" + nsprrel + "/src/"
    nsprtar_with_path = nspr_dir + nspr_tar

    nspr_releases_url = "https://ftp.mozilla.org/pub/nspr/releases"
    if not os.path.exists(nsprtar_with_path):
        os.makedirs(nspr_dir, exist_ok=True)
        check_call_noisy(
            [
                "wget",
                f"{nspr_releases_url}/v{nsprrel}/src/nspr-{nsprrel}.tar.gz",
                f"--output-document={nsprtar_with_path}",
            ]
        )

    if not os.path.exists(nsprtar_with_path):
        exit_with_failure(
            "cannot find nspr archive at expected location " + nsprtar_with_path
        )

    nss_stagedir = stagedir + "/" + nssreltag + "/src"
    if os.path.exists(nss_stagedir):
        exit_with_failure("nss stage directory already exists: " + nss_stagedir)

    nss_tar = "nss-" + nssrel + ".tar.gz"

    check_call_noisy(["mkdir", "-p", nss_stagedir])
    check_call_noisy(
        [
            "hg",
            "archive",
            "-r",
            nssreltag,
            "--prefix=nss-" + nssrel + "/nss",
            stagedir + "/" + nssreltag + "/src/" + nss_tar,
            "-X",
            ".hgtags",
        ]
    )
    check_call_noisy([tar_cmd, "-xz", "-C", nss_stagedir, "-f", nsprtar_with_path])
    print("changing to directory " + nss_stagedir)
    os.chdir(nss_stagedir)
    check_call_noisy([tar_cmd, "-xz", "-f", nss_tar])
    check_call_noisy(["mv", "-i", "nspr-" + nsprrel + "/nspr", "nss-" + nssrel + "/"])
    check_call_noisy(["rmdir", "nspr-" + nsprrel])

    nss_nspr_tar = "nss-" + nssrel + "-with-nspr-" + nsprrel + ".tar.gz"

    check_call_noisy([tar_cmd, "-cz", "-f", nss_nspr_tar, "nss-" + nssrel])
    check_call_noisy(["rm", "-rf", "nss-" + nssrel])
    check_call("sha1sum " + nss_tar + " " + nss_nspr_tar + " > SHA1SUMS", shell=True)
    check_call(
        "sha256sum " + nss_tar + " " + nss_nspr_tar + " > SHA256SUMS", shell=True
    )
    print("created directory " + nss_stagedir + " with files:")
    check_call_noisy(["ls", "-l"])

    if "y" not in input("Upload release tarball?[yN]"):
        print("Release tarballs have NOT been uploaded")
        exit(0)
    os.chdir("../..")
    gcp_proj = "moz-fx-productdelivery-pr-38b5"
    check_call_noisy(["gcloud", "auth", "login"])
    check_call_noisy(
        [
            "gcloud",
            "--project",
            gcp_proj,
            f"--impersonate-service-account=nss-team-prod@{gcp_proj}.iam.gserviceaccount.com",
            "storage",
            "cp",
            "--recursive",
            "--no-clobber",
            nssreltag,
            f"gs://{gcp_proj}-productdelivery/pub/security/nss/releases/",
        ]
    )
    print_separator()
    print(
        f"Release tarballs have been uploaded to Google Cloud Storage. You can find them at https://ftp.mozilla.org/pub/security/nss/releases/{nssreltag}/"
    )
    print_separator()


o = OptionParser(
    usage="client.py [options] "
    + " | ".join(
        [
            "remove_beta",
            "set_beta",
            "print_library_versions",
            "print_root_ca_version",
            "set_root_ca_version",
            "set_version_to_minor_release",
            "set_version_to_patch_release",
            "set_release_candidate_number",
            "set_4_digit_release_number",
            "make_release_branch",
            "create_nss_release_archive",
            "generate_release_note",
            "generate_release_notes_index",
        ]
    )
)

try:
    options, args = o.parse_args()
    action = args[0]
    action_args = args[1:]  # Get all arguments after the action
except IndexError:
    o.print_help()
    sys.exit(2)

if action in ("remove_beta"):
    remove_beta_status()

elif action in ("set_beta"):
    set_beta_status()

elif action in ("print_library_versions"):
    print_library_versions()

elif action in ("print_root_ca_version"):
    print_root_ca_version()

elif action in ("set_root_ca_version"):
    set_root_ca_version(action_args)

# x.y version number - 2 parameters
elif action in ("set_version_to_minor_release"):
    set_version_to_minor_release(action_args)

# x.y.z version number - 3 parameters
elif action in ("set_version_to_patch_release"):
    set_version_to_patch_release(action_args)

# change the release candidate number, usually increased by one,
# usually if previous release candiate had a bug
# 1 parameter
elif action in ("set_release_candidate_number"):
    set_release_candidate_number(action_args)

# use the build/release candiate number in the identifying version number
# 4 parameters
elif action in ("set_4_digit_release_number"):
    set_4_digit_release_number(action_args)

# create a freeze branch and beta tag for a new release
# 2 parameters
elif action in ("make_release_branch"):
    make_release_branch(action_args)

elif action in ("create_nss_release_archive"):
    create_nss_release_archive(action_args)

elif action in ("generate_release_note"):
    print(generate_release_note(action_args))

elif action in ("generate_release_notes_index"):
    generate_release_notes_index(action_args)


elif action in ("release_nss"):
    release_nss(action_args)

else:
    o.print_help()
    sys.exit(2)

sys.exit(0)